Among them was a beautician, a martial arts instructor and a financial service adviser, and together they managed to conduct one of the most complex spying operations of our time. Mark Hollingsworth looks at the origins of the freelance spy ring and how even the suburbs of Norfolk are now not immune from the sinister spying of Putin’s secret agents
Sitting in the unlikely setting of the Haydee Hotel, a modest eight-room guest house in Great Yarmouth, on the Norfolk coast, a Bulgarian spy called Orlin Roussev sends an encrypted message via Telegram to his controller. He discusses ideas for covert operations to destabilise the Kazakhstan government: “Hacking Kazakh nuclear power, leaking sex videos and crushing their currency…. also, maybe a deep fake porn video of the son of the president.”
“Yes, these are cool and very feasible,” responds his intelligence handler.
“We need a gay club owner or security who can give an interview that the son of the Kazakh president is a regular gay customer,” adds an excited Roussev.
“Well, make it REAL-FAKE. We must use some actual facts or at least it leaks for the son to have been in London.”
“I know a few of the top UK porn stars and the circles with the elite clubs, SWING etc. We can check or at least create a real fake story.”
“Perfect”
That exchange took place on 31 August 2022 and is one of 80,000 Telegram messages Roussev exchanged with his spymaster codenamed “Rupert Ticz”. His channel is just one of hundreds of spyware devices seized by police during a raid of his tiny room at the Great Yarmouth guest house.
The extraordinary cache included hidden bugs and signal jammers, 88 audio and visual recording devices, 221 mobile phones, 495 SIM cards and 11 drones. Spy cameras were hidden in sunglasses and stuffed toys amidst piles of fake identity documents, notably 75 passports and 91 bank cards in various names.
The police raid resulted in the prosecution of several Bulgarian nationals under the Official Secrets Act for carrying out illegal surveillance in the UK with plans to burgle, honeytrap, murder and kidnap targets, notably investigative journalists. The prosecution alleged between August 2020 and February 2023, these agents were part of a network gathering intelligence useful to Russia and “for a purpose prejudicial to the safety and interest of the (UK) state”.
On Friday, Vanya Gaberova, Katrin Ivanova, and Tihomir Ivanchev were all found guilty of spying for Russia, in what police have described as “one of the largest” foreign intelligence operations in the UK.
Court sketches of Vanya Gaberova (left), Katrin Ivanova and Tihomir Ivanovopen image in gallery
Court sketches of Vanya Gaberova (left), Katrin Ivanova and Tihomir Ivanov (PA)
On the surface, the espionage appears to be part of Putin’s secret hybrid war against the West. In 2022, the Bulgarian operatives carried out surveillance on Patch Barracks, a US military airbase in Stuttgart which trained Ukrainian soldiers to use US Patriot missiles against Russia. Using highly sophisticated technology, Roussev planned to use IMSI grabbers to hack the mobile phones of Ukrainian soldiers at the barracks. This enabled the Russians to trace the Patriot missiles using information stored on the hacked phones.
The spies also focused on the formidable Bulgarian investigative journalist Christo Grozev, who exposed Kremlin links to the 2018 Salisbury attacks and was instrumental in uncovering the Russian intelligence attempt to assassinate the anti-Putin dissident Alexei Navalny. Grozev was a prime target and so tracked by the group in different locations in Austria, Spain and Montenegro.
Christo Grozev, who exposed Kremlin links to the 2018 Salisbury attacks, was a target of the spy ringopen image in gallery
Christo Grozev, who exposed Kremlin links to the 2018 Salisbury attacks, was a target of the spy ring (PA Archive)
Two of the Bulgarian agents planned to engineer a fake romance between him and their accomplice, the London-based Gaberova. This included her sending the journalist a Facebook request, taking pictures of him at a conference in Valencia and eating breakfast at his hotel. The Bulgarians also discussed robbing, kidnapping, killing him and burning down his house – such was the hatred of a journalist who dared to expose the crimes of Putin and his private army, the FSB (Federal Security Service).
A second operation targeted another troublesome investigative journalist, Roman Dobrokhotov, founder of The Insider, whose articles displeased the Kremlin. As part of their surveillance, a female spy sat next to him on a flight from Budapest to Berlin, where she used covert recording equipment and captured his iPhone PIN number. During discussions about this operation in 2021, Ticz allegedly commented: “I would love to kidnap the guy now even more.”
But The Independent has discovered an intriguing sub-plot to this case which highlights the growth of a dark economy for commercial clandestine services, notably deception, psychological warfare and even assassinations. It is plausible that the Bulgarian spies were also operating as espionage mercenaries, motivated by financial and commercial interests or even personal excitement as well as state-directed objectives. Their value as rogue actors was being outside the constraints and oversight associated with state intelligence agencies.
A surveillance image of Christo Grozev, which was shown to the juryopen image in gallery
A surveillance image of Christo Grozev, which was shown to the jury (Metropolitan Police/PA Wire)
The main clue is the identity of the mysterious spymaster Rupert Ticz. He turns out to be the notorious Jan Marsalek, the Austrian businessman wanted in Germany for his part in a £1.6bn fraud after the collapse of the payment company Wirecard. He paid the Bulgarian spies through a UK company called JM Consult Ltd, registered in Greenford, and is now living in Moscow under the Kremlin’s protection using a secret identity.
While acting as Wirecard’s chief operations officer, Marsalek paid private spy contractors to hack emails and orchestrate disinformation campaigns against journalists. He specialised in blending real facts with fabrications to ensure his deception was more convincing. It is possible he was acting on behalf of the Kremlin.
On the surface, the espionage appears to be part of Putin’s secret hybrid war against the West
But people who knew him doubt this was his primary motivation and client. “Marsalek carried himself with the theatrical swagger of a Bond villain audition,” a former senior UK intelligence officer told The Independent. “His compulsive name-dropping of state intelligence services and loose talk of private operatives on speed dial ready to do his bidding revealed a fundamental misunderstanding of professional intelligence work.
“He was a textbook manifestation of pathological narcissism compounded by adolescent delusions of grandeur. While undoubtedly his financial means and shady contacts meant he could access government-grade technology, his absence of genuine tradecraft was palpable. What he misconstrued as espionage amounted to amateur dramatics. Frankly, I found the man to be a total clown. But that’s not to say he was not dangerous – his wealth, his criminal underworld contacts, together with his personality meant he could cause very serious damage to anyone in his crosshairs.”
The next clue that this case may not be a sophisticated Russian operation lies in the poor tradecraft exhibited by the Bulgarian spies and the reckless, risky and brazen antics of the cell members, especially Marsalek.
A fake press card ID used by Bizer Dzhambazovopen image in gallery
A fake press card ID used by Bizer Dzhambazov (Metropolitan Police/PA Wire)
Only one operative, Orlin Roussev, had an intelligence background. He previously owned a signals intelligence company selling communications equipment and worked in financial services. Between 2008 and 2009, he was a strategic adviser to the Bulgarian Ministry of Energy. In December 2020, he was granted EU settled status but then chose the unlikely setting of a guest house in Great Yarmouth as the operating hub of his covert surveillance.
The other Bulgarian agents lived quietly in Harrow, and in the west London suburbs of Greenford and Acton. Their cover professions are ingenious and varied. One, Ivan Stoyanov – nicknamed “The Destroyer” – claimed to be a mixed martial arts fighter. Another, Vanya Gaberova, is a beautician who specialises in eyelashes and runs a salon called Pretty Woman. Bizer Dzhambazov had connections at the highest echelons of the Bulgarian government. His contribution was to persuade his long-term girlfriend Katrin Ivanova to take photographs of army barracks. This backfired badly as she then testified against him during the trial and denied being part of a spy ring.
Over the course of three years, the Bulgarian spy ring plotted six covert operations which were “extremely risky” and included attempted abduction, filming their targets, orchestrating direct contact and using the female defendants as sexual bait to gather information.
Vanya Gaberova ran her own salon in west London called Pretty Womanopen image in gallery
Vanya Gaberova ran her own salon in west London called Pretty Woman (PA Media)
The prosecution’s case was based on the Telegram messages between Roussev and Marsalek. Their conversations included how to obtain military equipment on behalf of Russia, the provision of espionage tools and digital devices and arranging physical surveillance against targets of the Russian state.
A statement was provided by the deputy national security adviser Matt Collins, who gave “a high-level HMG assessment of the activity of the suspects and impact on UK security and interests”.
But Marsalek was described as “believed to be linked to the Russian state” – hardly a compelling or convincing indictment. And when he tasked Roussev to discredit the son of the Kazakhstan president, this was justified, said Marsalek, because “he did not condemn the war in Ukraine”. This comment indicates Marsalek was, at the very least, promiscuous in his allegiances.
In their summing up, the prosecution warned the jury the lawyers for the Bulgarian spies would focus on their “amateurish antics being funny”, implying their actions were akin to Inspector Clouseau or Austin Powers rather than James Bond or a Le Carre novel. “But it’s not funny at all,” said the prosecutor. “They were not stupid. This was high-level espionage with very high stakes.” There is no doubt the stakes were high but the involvement of wealthy businessmen like Marsalek in intelligence operations introduces a dangerous new dimension which could disrupt, destabilise and damage an already unstable world.
Even the quiet suburban streets of west London and the unassuming guest houses of the Norfolk coast are not immune to the international spying game.